[kyle-sexton]

No related issue: G6 part 2 of the lane-funding plan (owner-approved 2026-10-23).

Summary

Registers intake-triage.yml@d02b8697e092705153f0996549b05f95a446bb52 and pr-review-cli.yml@d02b8697e092705153f0996549b05f95a446bb52 (ci-workflows v0.65.0), so claude-code-plugins' intake and review callers can re-pin to the release whose lane-outcome record carries costUsd.

Fix

v0.65.0 changes only report-lane-outcome's classify.cjs (ci-workflows#872). Both reusables reach that action through $/. Neither workflow file changed since its last registered SHA (git log 2fe38c03..v0.65.0 -- .github/workflows/intake-triage.yml and git log v0.64.2..v0.65.0 -- .github/workflows/pr-review-cli.yml list no commits), so both contracts copy their prior entries forward verbatim.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 341 pass. That count includes the new copy-forward test, which checks both entries deep-equal their prior SHAs' entries and that exactly two contracts name the new SHA.
• Left out: nothing.

Related

• Same shape as #853 (v0.64.2).
• Next: the standards sync into claude-code-plugins, then that repository's caller re-pin.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T21:24:41.058413Z	652b43e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 652b43ef782b6a80ae30413c953e5a6cbd9311d7: 0 finding(s), 0 as inline comments.

Security review: PR #856 at 652b43e

critical-findings: 0

I found no security issues in this pull request.

What changed. The PR adds two entries to approvedReusableWorkflowContracts in components/runner-policy/policy.json. They cover intake-triage.yml and pr-review-cli.yml, both pinned to d02b8697… (the ci-workflows v0.65.0 tag). It also adds one test in runner-policy.test.mjs that checks they match the earlier entries.

Checks.

• Copy-forward. I compared each new entry with its predecessor in the file: intake-triage @ 2fe38c03… and pr-review-cli @ 6d6cb798…. They match field for field:

  • the routing, role and fixed runner;
  • the input allowlists;
  • the secret mappings, which stay on the AUTOMATIONS_* and REVIEWS_* secrets;
  • the caller permissions (contents: read, issues: write) for intake-triage.

  Nothing is widened: no new input, no new secret, no higher permission, and no change to the hosted-only or runner-input routing.

• Pins. Both references are full 40-character commit SHAs, not branch or tag names.

• Old entries. The old entries stay in place, which is the existing pattern for in-flight callers. The test asserts exactly two entries for the new SHA.

• Not verified. I did not confirm that d02b8697… is the v0.65.0 commit. The environment had no network access to check, and I did not run the test suite. The PR text says v0.65.0 changes only report-lane-outcome's classify.cjs, and I could not check that either.

• Trust-gate paths. The PR touches none of .github/standards/trusted-actors/**, check-trusted-trigger, CODEOWNERS or .gitmodules, so nothing needs a hold.

• Instruction surfaces and plugin manifests. The PR deletes or softens no instruction text and changes no manifest, so there are no manifest <field> lines.

[github-actions]

claude-review reviewed 652b43ef782b6a80ae30413c953e5a6cbd9311d7: 0 finding(s), 0 as inline comments.

No findings.

The PR adds two approvedReusableWorkflowContracts entries for ci-workflows v0.65.0 (d02b8697…) in components/runner-policy/policy.json: intake-triage.yml and pr-review-cli.yml. It also adds a copy-forward test in runner-policy.test.mjs.

• Verbatim copies (checked by reading the file).
  • The new intake-triage entry matches the 2fe38c03… entry field for field: routing, runnerInput, role, allowedInputs, allowedSecrets and allowedCallerPermissions.
  • The new pr-review-cli entry matches the 6d6cb798… entry field for field: hosted-only, fixedRunsOn, allowedInputs and allowedSecrets.
• Not run. The shell sandbox refused my node invocations, so I did not run the test suite. The 341-pass count is author-claimed and unverified by me.
• Test. The new test compares both entries to the prior-SHA entries and asserts exactly two contracts name the new SHA. This matches the file's neighbouring copy-forward tests. I checked by reading that policy.json contains the two entries and that the predecessor SHAs exist.
• Claim that the workflow files are unchanged. I have not verified it, because the ci-workflows repo is outside this review's scope. The PR gives the git log commands behind it.
• Closing issue. The PR states No related issue: …, so there are no acceptance criteria to check.
• PR body contract. The body opens with a No related issue: line and fills Summary, Fix, Verification and Related.
• Hold classes. None apply. The change adds no model or API spend, does not touch trust-gate paths and has no critical security finding. The entries only register already-approved contract shapes.